- security: add mealie_base_url / mealie_api_token vault keys and
write/read/deleteMealieCredentials() to CryptoManager; the pairing
persists only in the platform keystore (Keychain / EncryptedSharedPreferences /
DPAPI) and never enters controller state
- data: add MealieApiClient - testConnection probes GET /api/app/about with
GET /api/recipes?perPage=1 fallback (200 = connected); fetchAllRecipes lists
GET /api/recipes?perPage=-1 and enriches each summary with
GET /api/recipes/{slug}, mapping recipeIngredient (structured maps + strings),
recipeInstructions (section flattening), nutrition display strings, ISO-8601
prep/cook times, yield, image + source URLs; Mealie UUID reused as Recipe.id
- data: add AppDatabase.upsertRecipe (insertOnConflictUpdate) and
DriftRecipeRepository.syncFromMealie preserving createdAt on re-sync
- presentation: add MealieIntegrationController (async credential load,
connectivity-gated Test & Save, Sync Now with spinner state, Disconnect,
isMealieRecipe badge/filter helper) plus api/sync providers
- settings: add Private Recipe Integrations card - Connect Mealie modal with
server URL hint, obscured API token field, Test & Save before persistence;
connected state shows endpoint, Sync Now and Disconnect
- recipes: add All / Web Scraped / Mealie source filter chips, subtle Mealie
badge on synced cards, and AppBar Sync Private Recipes action when configured
- fix _SettingsCard title Row overflow at 390dp (Expanded wrap) caught by the
mobile navigation widget test; add mealie_parser_test.dart (14 tests), suite
green at 184/184, flutter analyze clean
- docs: add architecture 4.9 Mealie design and multiplatform UX adaptation
spec; BUILD_STATE marks Phase 4B complete
Cloud connector framework: ICloudHealthConnector contract, supportsCloudSync / isCloudSyncReady on IHealthGateway, and a HealthProviderType.googleHealth slot; a conditional-import shim (io implementation / web stub) keeps platform channels out of web builds.
Google Health connector (successor to the retired Fitbit Web API, shutdown 2026-10-30): OAuth2 authorization-code + PKCE through the system browser with a loopback redirect; read-only activity-and-fitness + health-metrics scopes; tokens in flutter_secure_storage with transparent refresh; paginated weight and active-energy-burned dataPoints reads with kg-to-lb normalization from the per-point unit field; pure unit-tested parsers.
Gateway wiring: both drivers store injected connectors (desktop runs MobileHealthGateway through the io conditional import; the fallback driver is web-only); cloud status/authorize/disconnect route first and reads merge native + cloud non-fatally; syncFromHealth accepts cloud-only sources and imports persist as BiometricSource.cloudSync.
UI: Google Health row in Settings with Connect/Disconnect and auto-import on connect; explanatory desktop copy on the Apple Health and Health Connect rows; the Nutrition weight card syncs through a connected cloud partner and surfaces the outcome as a snackbar, degrading to the manual dialog when no source is connected.
Field fixes recorded in BUILD_STATE: io-driver connector wiring, duplicate-implementation merge correction, weight-card sync gate. Tests: google_health_parser_test suite; settings_screen_test updated for the fourth integration row. The legacy Fitbit connector was fully removed before shipping.
Implements architecture section 4.7: IHealthGateway now exposes the Phase 3B contract (HealthProviderType, HealthConnectionStatus, HealthDataPayload, checkStatus/requestAuthorization/fetchLatestBiometrics/disconnect) with defaults derived from the existing primitives. Drivers and test fakes switch from implements to extends so Dart inherits the default bodies.
- Mobile driver: BLOOD_GLUCOSE added to iOS/Android read sets (mmol/L to mg/dL normalization); checkStatus probes hasPermissions plus Health Connect SDK readiness; samsungHealth aliases the Health Connect binding on Android (federated Samsung/Pixel feeds); disconnect clears the cached SDK probe.
- Fallback driver: safe dummy states on Windows/Web/macOS (manualFallback connected, enterpriseFhir notConfigured, native unsupportedPlatform); fetchLatestBiometrics serves the encrypted drift cache; zero platform-channel calls.
- Settings: IntegrationsController rewritten from toggles to status orchestration (refreshStatuses, connect/disconnect round-trips, denial to permissionDenied plus snackbar); SettingsScreen gains a Health Integrations card with Apple Health, Health Connect (Samsung & Pixel), and SMART on FHIR rows showing live status badges and Connect/Disconnect buttons with desktop-safe disabled states.
- Manifests: Android adds READ_BLOOD_GLUCOSE, healthdata package query, ACTION_SHOW_PERMISSIONS_RATIONALE intent, and ViewPermissionUsageActivity alias; iOS adds NSHealthShareUsageDescription and NSHealthUpdateUsageDescription.
- Tests: +13 (fallback dummy-state matrix, integrations controller transitions, Settings desktop disabled-states and mobile connect/disconnect round trip); existing fake switched to extends; navigation test updated for the renamed card title.
Verified: build_runner 191 outputs; flutter analyze clean; flutter test 148/148; flutter build windows debug succeeded.
- Exercise feature (lean-mass preservation): MuscleGroup enum + ExerciseEntry
entity, IExerciseRepository contract with session-scoped in-memory
implementation, ExerciseController with weekly distinct-session rollup vs.
the recommended 3 sessions/week target, ExerciseScreen (weekly strength
frequency card, day-grouped working-set log with swipe-to-delete) and the
LogExerciseDialog (muscle group / name / sets / reps / weight).
- Recipe Vault: new features/recipes screen with pinned URL import bar wired
to RecipeImportController, search field + macro filter chips (Protein >
30g / > 20g / Under 500 kcal / All), responsive GridView.builder
(SliverGridDelegateWithMaxCrossAxisExtent) with chunked infinite scroll,
read-only details bottom sheet, and delete confirmation.
- Meal planner refactor: strip the screen to week navigation + the 7-day
calendar (Mon-Sun) with daily protein rollups; replace the inline import
bar, SavedRecipesTray, and AssignSlotDialog with the searchable
AssignRecipeSheet modal bottom sheet (Recipe Vault search + custom-entry
fallback); empty slots render a "+ Assign Recipe" affordance; drop the
drag-and-drop tray plumbing.
- Settings: new features/settings screen with Identity (email, Supabase
status badge, sign-out), Targets (daily protein/water inputs feeding the
new NutritionController.updateTargets), Security & Storage (SQLCipher
AES-256 badge with web-degradation note), and Integrations (Apple Health /
Health Connect / HealthGateway toggles via IntegrationsController through
the IHealthGateway boundary).
- Shell: register /exercise, /recipes, /settings routes; expand the desktop
NavigationRail to the 7 specified destinations (medication_liquid,
restaurant, fitness_center, calendar_month, menu_book, inventory_2,
settings) with labelType.all inside a height-constrained scroll view;
mobile keeps 4 core bottom-bar tabs plus a "More" tab opening the
secondary-destinations drawer.
- Android toolchain fixes (first-ever Android build): enable core library
desugaring + desugar_jdk_libs 2.1.4 for flutter_local_notifications, set
kotlin.incremental=false (pub cache on C: vs project on D: breaks the
incremental compiler), and raise minSdk to maxOf(flutter, 26) for the
health plugin.
- Mobile overflow fix: LogInjectionDialog compound dropdown gains
isExpanded + ellipsis so long labels ("Tirzepatide (Mounjaro /
Zepbound)") no longer paint stripes at phone widths.
- Web drift assets: commit web/sqlite3.wasm (sqlite3-3.7.1 release, matching
the locked package) and web/drift_worker.js (drift-2.35.2) so the WASM
database opens at runtime; both were missing and every drift operation
failed in Chrome.
- Recipe import hardening: browser-like Accept/Accept-Language/User-Agent
headers on native (403 anti-bot bypass; UA stripped on web), optional
--dart-define=RECIPE_PROXY_URL routing downloads through a server-side
proxy, actionable CORS guidance in the web error path, and a deployable
Supabase Edge Function relay (supabase/functions/recipe-proxy) with
http(s)-only validation, SSRF host guard, 2 MiB cap, and 15 s timeout.
- Tests: 123 -> 135 (exercise controller/screen, log-injection dialog
320dp/390dp overflow regressions, scraper header/proxy/error-path
hardening, meal planner calendar-only rewrite); navigation integration
tests now cover all 7 rail routes and the mobile More drawer.
- Docs: README web recipe-import (CORS proxy) section; BUILD_STATE.md
Phase 7 deliverables, Post-Phase-7 additions, and checklist updated.
Verified: dart analyze lib test clean, flutter test 135/135,
flutter build windows --debug, flutter build apk --debug, and
flutter build web --no-tree-shake-icons all succeed.
Mike Kell